Packet fragmentation techniques break malicious traffic into smaller, irregular pieces to hide it from firewalls, IDS, and IPS. These systems often rely on analyzing complete packets, normal protocol flows, or known attack signatures. When packets are fragmented or delivered out of order, detection engines may fail to reconstruct the full payload, allowing attacks, scans, or data transfers to slip through unnoticed. This chapter explains how fragmentation works, why it bypasses detection, and how attackers use it during pentesting.

Understanding Packet Fragmentation

Packet fragmentation splits a large packet into multiple smaller packets. Each fragment is delivered separately and reassembled at the destination. IDS/IPS must reassemble fragments correctly to detect malicious behavior. If fragmentation is crafted carefully, these systems may:

• Fail to reassemble packets

• Misinterpret packet content

• Miss exploit signatures

• Crash reassembly buffers

• Ignore malformed fragments

Fragmentation is most effective against older or misconfigured detection devices and heavily filtered environments.

Core Fragmentation Concepts

MTU (Maximum Transmission Unit)

Networks transmit packets up to a certain size (e.g., 1500 bytes on Ethernet). Larger packets must be fragmented.

Fragment Offset

Indicates where each fragment belongs in the original packet.

DF (Don’t Fragment) Flag

If set, routers will drop packets instead of fragmenting them.

Overlapping Fragments

Attackers intentionally create fragments that overlap or contradict each other to confuse reassembly logic.

Technique 1: Using Nmap’s Built-In Fragmentation

Nmap can automatically fragment probe packets, reducing their size to stay under detection thresholds.

Basic Fragmentation Scan

nmap -f 10.10.20.5

This breaks packets into 8-byte fragments to evade signature matching.

Aggressive Fragmentation

nmap -ff 10.10.20.5

More fragmentation → harder for IDS to reassemble.

Combine Fragmentation with SYN Scan

nmap -sS -f 10.10.20.5

This reduces obvious scanning patterns.

Technique 2: Custom Fragmentation with hping3

Attackers manually craft fragmented packets to confuse inspection engines.

Send Fragmented SYN Packets

hping3 -S -f -p 445 10.10.20.5

Fragmenting Packets with Small Size

hping3 -S -p 80 --mtu 64 10.10.20.5

Small MTU values create many fragments for a single request.

Out-of-Order Fragmentation

hping3 -S --fragoff 10 -p 445 10.10.20.5

Out-of-order offsets force IDS to handle unexpected sequences.

Technique 3: Overlapping Fragment Attacks

Overlapping fragments confuse IDS reassembly logic because:

• The attacker sends two fragments that “overlap”

• IDS reassembles them differently than the target machine

This can hide malicious data inside the overlap.

Example

Send harmless content first, then overwrite with malicious bytes inside later fragments.

Most modern IPS devices normalize overlapping fragments, but misconfigured or outdated systems remain vulnerable.

Technique 4: Tiny Fragments / Mutated Payload Delivery

Send payloads in extremely small fragment sizes to dilute recognizable signature bytes.

Tiny Fragments Approach

[ Malicious Payload ] → split into → [ 8-byte fragments ]

Attackers use tools to split shellcode or exploit payloads into many tiny fragments so IDS sees only harmless partial sequences.

This is highly effective for signature-based IDS.

Technique 5: Protocol Evasion with Mixed Fragmentation

Mix fragmentation with other evasion tactics:

• Time gaps between fragments

• Random fragmentation sizes

• Fragment dropping and retransmission

Randomized Fragmentation (hping3)

hping3 -S -p 22 --rand-source -f 10.10.20.5

Combination of randomness + fragmentation improves stealth.

Technique 6: Fragmentation to Evade Firewall Rules

Firewalls may only inspect the first few bytes of a packet.

Attackers fragment payloads so the first fragment contains:

• Legitimate-looking header bytes

• No detectable malicious patterns

The malicious part is hidden in follow-up fragments.

Example Approach

Fragment 1: harmless
Fragment 2-n: malicious data

If firewall does not reassemble fragments → full stealth.

Technique 7: Splitting HTTP or Application Payloads

Attackers fragment higher-layer protocols manually.

Fragment HTTP Header + Payload

Instead of:

GET /malicious.php

Send:

GET /
mal
icious.php

IDS may fail to match URL-based signatures.

Fragmentation works especially well with:

• SQL injection payloads

• Command injection payloads

• Directory traversal payloads

• XSS or encoded scripts

Technique 8: Using IPv6 Fragmentation for Evasion

IPv6 fragmentation is less commonly inspected and frequently misconfigured.

Example IPv6 Fragmentation Using Scapy (Python)

(Conceptual)

• Create IPv6 header

• Add fragmentation extension header

• Send multiple fragments with overlaps

IPv6 fragment evasion is extremely effective against outdated or legacy equipment.

Technique 9: Combining Fragmentation With Encryption

Encrypted tunnels + fragmentation make detection almost impossible.

For example:

1. Encrypt payload using SSH or HTTPS

2. Fragment packets using hping3 or protocol-level behavior

3. Send them over an allowed outbound port

IDS sees fragmented encrypted blobs with no readable data.

Why Packet Fragmentation Evasion Works

Fragmentation confuses detection systems because:

• Many IPS/IDS engines struggle with large numbers of tiny fragments

• Reassembly often differs between IDS and target host

• Stateful reassembly buffers can overflow or fail

• Fragmentation breaks recognizable attack signatures

• Overlapping fragments cause ambiguity

• Firewalls may inspect only the first fragment

• TLS/SSH wrappers blind DPI and inspection

Fragmentation is especially effective in older networks, lightly configured IDS environments, or segmented environments using basic firewall filtering.

Intel Dump

• Fragment packets to hide malicious content

• Use Nmap -f or -ff for fast automated fragmentation

• hping3 supports custom fragmentation, offsets, and MTU manipulation

• Overlapping fragments confuse IDS reassembly

• Tiny fragments break attack signatures

• Fragmentation hides payloads from firewalls that inspect only first fragments

• IPv6 fragmentation is a powerful modern evasion vector

• Combining fragmentation with encryption makes traffic invisible